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What You Will Learn 



• Project Lifecycle: Evolution of Limits and Branch Products 


• Developing the Requirements Table: Flight Limits 
o Flight Limits Definition 

o How Limits Should be Generated 
o Gradients/Limits Location 
o Working with the Component PDL 
o Gold Rules Margins 

• Developing the Requirements Table: Test Qualification Goals 
o Test Margin Definition 

o Qual versus Acceptance 
o Passive Versus Active 
o GEVS requirements 
o Role of Analysis Predictions 
o Limits Tolerances 


TFAWS 2015 Carol Mosier 




Acronyms and Reference Documents 


>1 3 )) 

• 

AFT- Allowable Flight Temperature 


• 

CM - Configuration Management 


• 

CPL -Capillary Pumped Loop 


• 

Ebox- Electronics Box 

Documents that govern GSFC Limits: 

• 

GEVS - General Environmental Verification 


Specification 

• 545-PG-8700.2.1.B (Branch Guidelines) 

• 

GOLD - Goddard Open Learning Design 

• GSFC-STD-7000 (GEVS - Standards for Testing) 

• 

GSFC - Goddard Space Flight Center 

• GSFC-STD-1000 (GOLD rules - Standards for 
Design/Testing) 

• 

LHP-Loop Heat Pipe 

• 

MEB - Main Electronics Box 


• 

NEI - Non-explosive Initiator 


• 

Op - Operational 


• 

PDL - Product Design Lead 


• 

PDR- Preliminary Design Review 


• 

PG - Procedures and Guidelines 


• 

S/C - Spacecraft 


• 

SRR- Systems Requirements Review 


• 

STD- Standard 


• 

TEC-Thermo-Electric Cooler 


• 

TVDS - Thermal Vacuum Data System 
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What You Will Learn 



• Developing the Test Sensor Limit Spreadsheet 

o Yellow Versus Red Test Limits 
o Sensor Position 
o GEVS Wording 

o Progression of Qualification Goals throughout the Test Program 
o Reality of Testing (Helpful Hints) 

• Developing the Flight Sensor Limit Spreadsheet 

o Yellow Versus Red Flight Limits 
o Guidelines - Mode Based Limits 
o Reality of Flight Database (Helpful Hints) 

• Summary of Branch Policies on Limits 
Examples interspersed throughout this package: 

Examplei - Defining the Limits for Requirements Table 
o Example 2: Defining the Qualification Goals for the Requirements Table 
Example 3: Qualification Goal from Analysis Predictions 

Example 4: Determining the Test Sensor Limit in the Database at the Requirement Location 
Example 5 : Test Limits and Sensor Position 

Example6: Progression of Qualification Goals and Associated Tolerances 
Example 7: Implementing Flight Limits 
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Project Lifecycle: Evolution of Limits 



SRR Limits 
Requirements 

Developed and 
Owned by 
Component PDL 

Limits based on 
Hardware/ science 
constraints 


Spreadsheet of 
Limits maintained 
by Systems 
Engineer & 
changes agreed 
upon 


Test Qual Goals 
Requirements 


GSFC Policy is a 
MINIMUM goal of 
10 C Op margin 
over AFT 


No margin on 
Survival Limits 
(with PDL agreed 
to temperature 
tolerances) 


PDR Limits 
Requirements 

SRR limits may 
have been 
adjusted based on 
updated 
information on 
design 

Thermal Branch 
Recommends that 
project have 
thermal limits 
under 

configuration 
management at 
PDR 



Test Limits 

•The requirements 
table is used to 
determine sensor 
limits based on 
analysis. 
•Developed for 
both flight and 
test sensors 
•Modified as 
needed from 
component level 
to higher 
assembly tests 
• Includes the test 
tolerances agreed 
upon by 

component PDL 


¥ ^ 


Flight Limits 
Database 


•Based test 
qualification 
extremes and 
correlated flight 
model predicts 
•Developed per 
“State “ (i.e. 
operational, 
safehold, survival, 
decontamination, 
etc) 

•Yellow limits 
may be modified 
based on flight 
data 


r 


ft. 
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Project Lifecycle: Evolution of Branch Products 



SRR Limits 
Requirements 

Product 

Table of Limits 
(Op, Non-Op, turn On) 

Control 


Project Systems 
Engineer 


Test Qual Goals 
Requirements 

Product 

Table of Limits 
(Op, Non-Op, turn On, 
Qual Goals) 

Control 

Project Systems 
Engineer 

Additional Agreement 
with PDL and project 
on limits tolerances 


PDR Limits 
Requirements 

Product 

Table of Limits 
(Op, Non-Op, turn On, 
Qual Goals) 

Control 


Project CM 


Test Limits 
Database 

Products 


Spreadsheet 

(Red/Yellow Test Limits) 

Table 

(Qual goals/Tolerances ) 

Control 


Thermal PDL 

(Included in Test Plan 
with project CM) 


Flight Limits 
Database 

Product 


Spreadsheet 
(Red/Yellow Limits 
per mode) 

Control 
Developed by 
Thermal PDL and 
CM of Project 
Flight Database 


w ^ 


¥ ^ 


¥ ^ 


¥ ^ 


TYPES OF LIMITS PRODUCTS 


TABLE OF LIMITS 

Thermal Requirements 
Shown in Reviews 
Op/Non-op 
Flight/Qual 


SPREADSHEET OF 
TEST LIMITS 

Sensor -by -Sensor 
Op/Non-Op Test 
Conditions 


SPREADSHEET 
DATABASE OF 
FLIGHT LIMITS 

Sensor -by -Sensor 
Mission Modes Flight 
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DEVELOPING THE REQUIREMENTS TABLE 

“Flight Limits” 



THE PRIMARY DEVELOPMENT OF THE 
REQUIREMENTS TABLE IS FROM 

SYSTEMS REQUIREMENTS REVIEW (SRR) 
THROUGH PRELIMINARY DESIGN REVIEW 
(PDR) . SOME UPDATES MAY BE MADE AFTER 
PDR BASED ON DESIGN MATURITY. 
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Limits Definition 



• Op Limits (Allowable Flight Temperature AFT): The project approved 
minimum/maximum mission allowable temperatures when the 
component is operating. 

• Non-Op Limits (Survival) : The project approved minimum/ maximum 
mission allowable temperatures when the component is not operating. 

GSFC Terminology: Non-Op = Survival 

• Turn-On Limits : The temperature that the component may be powered 
on and operated without damage; however the performance may not be 
within spec. 



Turn-On Limits MUST be at least as wide as 
the Op qualification range but may be wider 



Minimum required survival limits are at the 
Op qualification range 
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Qualification Range Based on Limits 



Op Qualification Range: Typically +io°C more extreme than AFT 
limits. The component must operate within spec at qualification 
temperature levels. 

Non-Op (Survival) Qualification Ranee: T here is no margin required 
for survival qualification (the survival limit and the survival 
qualification range are the same). The minimum required survival 
limits are at the Op Qualification Range; However the branch 
recommends that survival limits are at least 5°C wider than this. 


Operational Qualification Range 
(minimum survival range) 



— 

— Op Limits (aft) — 

— ► 



Branch Recommended Qualification Range 


Survival Limits 


Turn-On Limits MUST be at least as wide as 
the Op qualification range but may be wider 

Minimum required survival limits are at the 
Op qualification range 


Branch recommends that survival limits are at 
least 5 C wider than Op qualification range 
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Cold 

Turn-on , 
Range 

◄— H 


Turn On Limits 



Operational Qualification Range 


Op Limits (AFT) 


Hot 

Turn-on 
Range 

H ► 


Survival Limits 


Cold Turn On Limit 

• The cold turn-on limit shall be set at or between the cold survival limit and the cold operational 
qualification range. 

•For cold turn-on limits below the operational limit there shall be a method of warming the component 
( i.e . active method such as heaters or self warming). 


Hot Turn On Limit 

•The hot turn-on limit shall be set at or between the hot operational qualification range and the hot 
survival limit. 

•For hot turn-on limits above the operational qualification range the thermal engineer shall verify that 
no limits (internal or external) would be exceeded when power is applied. 
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How Should Original (SRR) Limits Be Determined? 


• Mechanical Limitations 

• Electrical Part Limitations 

• Vendor Data: Previous Qualification (with Proper Derating) 

• Coating or Heater Constraints: Survival/ Adhesion 

• Working Fluid Limitations: Heat pipes 

• Science Constraints: Op Range (Instruments) 

The Hardware PDL owns the limits! 

Original Limits should NEVER be based on thermal predicts. 
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Location of Limits and Gradients 



• The location of where the limits requirements apply needs to be defined 
and understood. 

o Based on how the item is controlled and tested 
o At interfaces or directly on component 
o Location of sensors 

Although Limits can be defined ANYWHERE if the component PDL does not have 
a specific location where the limit needs to be defined the branch guidelines are as 
follows: 


Conductive Mounted Ebox (primary heat transfer 
| through base) Recommended Location: at 
mounting interface on substrate 

| Isolation Mounted Ebox (primary heat transfer through 
! radiator) Recommended Location: near radiator 
| or at control sensor/thermostat location if 
! actively controlled (e.g. heater on ebox) 


Other Actively Controlled Critical Components : 
At Control sensor/thermostat location 


Instruments - Recommended Location: at 
mounting interface on spacecraft surface. If 
isolated both ends of isolator should have 
temperature requirements. 


TFAWS 2015 Carol Mosier 




Working With the Component PDL 

SSR to PDR Level 



Determining Limits: 

• The limits should be based on the hardware constraints. However, at this early phase in the project, it 
maybe difficult for the PDL to determine his exact limits. Component PDL should be able to establish 
limits with rationale based on heritage if a similar design has flown. 

• In many instances the project will attempt to base the limits on the thermal predictions. However the 
thermal design/ analysis is impossible without knowing the hardware constraints. Consult branch 
management for preliminary temperature ranges if PDL is unable to set limits. 

• Limits (and their location) are iterated through PDR as the design matures. The systems engineer 
should keep a listing of the limits and rationale for changes. 

• Qualification Goals, Limits, and Test Tolerances are developed AFTER the Op and Non-Op limits are 
defined. 

Questions to Ask PDL/Svstems: 

• What is the temperature range that the component can operate within spec? (The AFT requirements 
are derived by subtracting the qualification margin) 

• What is the temperature range that the component can operate but may not be in spec? (Cold/Hot 
turn-on Limits) 

• What is the temperature range that the component can survive if powered off? (Survival limits) 

• Is there a specific location where the limit should be defined? If not then follow branch guidelines for 
limit location. 

• When do these limits apply? (For example the “Op” limits for dampers, actuators, etc. may only apply 
during deployment). 
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Example l : Defining the Limits for 
Requirements Table 



The PDL on the main electronics box (meb) on the WTE (wonderful thermal experiment) is 
allowing the box to be operational at -30 to +40° C and non-operational at -30 
to + 55 ° C. Define the AFT, survival, and turn-on limits. 


Limit Type 

Limits 

Notes 

Operational 

(AFT) 

-20 to +30°C 

At SSR the PDL may not know whether the component will be actively or 
passively controlled. You’ll learn about the differences in the next section. Until 
this is determined assume that the AFT is + io° C the maximum allowable 
operational range. Limits will be iterated as the design matures. 

Survival 

-30 to +55° C 

This is the range that the component PDL provided. This meets the minimum 
requirement of io° C more extreme than the AFT temperatures; However the 
branch recommends +15 0 C. Ask the PDL if the hardware survival limit could be 

-35 0 C The original number that he/she gave you might have been based on the 

minimum GEVS requirement and not a physical restriction of the hardware. 

Turn-On 

-30 to +40° C 
TBR 

The component PDL did not provide enough information to determine the turn- 
on ranges. The minimum range is shown; however the component may be able to 
be ON until it reaches +55 0 C. 


Note that the thermal PDL will also need to work with the component PDL to define the location that 
the requirement applies. Thermal PDL should explain that there are gradients within the component 
and test tolerances that allow temperatures to be outside the requirements table range. 
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Analysis and Gold Rules Margin 



Just a note that once the limits have been defined the thermal predictions 
should verify that there is at least 5 0 C margin. Before going to a more 
complex thermal control system inform the component PDL and systems 
engineer of the resources that would be needed (radiator area, heater 

power, mass, time, money, schedule, etc) Many times the limits can be 

adjusted. It never hurts to ask! 


Operational Limits (AFT) 


0 


O 


— Thermal Predictions — 

LB 

A| 


A| 


Survival (Non-Op) Limits 


Thermal Predictions 


5° C GOLD Rules Margin 
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DEVELOPING THE REQUIREMENTS TABLE 
“Test Qualification Goals” 



THE PRIMARY DEVELOPMENT OF THE 
REQUIREMENTS TABLE IS FROM 

SYSTEMS REQUIREMENTS REVIEW (SRR) 
THROUGH PRELIMINARY DESIGN REVIEW 
(PDR) . SOME UPDATES MAY BE MADE AFTER 
PDR BASED ON DESIGN MATURITY. 
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Test Margin Definitions 



After the Op, Non-Op, and Turn-on Limits have been defined at SRR the thermal PDL 
can determine the qualification requirements for each component based on GEVS. 

The qualification margins depend on how the component is thermally controlled AND if 
the required margin testing. 

Thermal Control Method 

Passive Systems -> Temperature controlled by coatings, radiators, MLI, doublers (no mechanical/ electrical parts or 
working fluids) increased temperature range cold/hot qualification 

Active Systems -> Non-passive temperature control (e.g. heaters, fluid loops, TECs, Louvers) -> reduction in cold 
qualification margin if heater power margin is met 

Fixed Set-Point -> Active Control but at one temperature -> no increase in temperature range; component is stressed 
through external environment variation 

Thermal Margin Requirement 

Qualification Thermal Margin - Environment used to prove the design of the test hardware by exposing design 
defects, to demonstrate robustness, to show tolerance to degradation (fatigue or wear) and to prove test condition 
tolerances. At GSFC Qual & Proto-qual (proto-flight) have the same requirements. Most hardware at GSFC is tested at 
this level. 

Acceptance Thermal Margin - Margin of safety applied to worst-case analytic temperature predictions to account 
for uncertainties. Acceptance level is less stringent then Qualification Level and may be done on previously qualified 
designs. 

Note: The definition of limits and the levels are different across NASA centers, private industry and 
other agencies. 


TFAWS 2015 Carol Mosier 



Qualification (Protoflight/Prototype) & Flight Acceptance Thermal- 



Vacuum Temperatures from GEVS GSFC-STD-7000 


18 


Note: this chart shows margins for a passively controlled component 
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Flight Allowable Qualification Goals 
Passively Versus Actively Controlled Component 


Passively 

Controlled 

Component 


Survival (Non-Op) Temperature Limits 


Non-Op Qualification Goals 


Actively 
Controlled 

4 ■' Operational Qualification Goals Component 


Survival (Non-Op) Temperature Limits 


4 Non-Op Qualification Goals 

* Maybe reduced to 5 C in special circumstances with branch review of design/analysis 


Margin reduced 
(additional criteria 
applies) 



Allowable Flight Temperatures (AFT) 
Operational Limits 





Allowable Flight Temperatures (AFT) 
Operational Limits 



Operational Qualification Goals 
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From GEVS gsfc-std-7ooo 



For passively controlled systems, a qualification temperature margin of no less than io°C above the “flight” 
maximum operating temperature and io°C below the “flight minimum operating temperature” shall be used in 
establishing test temperatures. 


The margins for acceptance previously qualified hardware may be reduced to 5°C, as long as testing to these levels 
does not preclude protoflight test levels from being achieved at higher levels of assembly. 

The test margins for actively controlled hardware shall apply to both qual/protoflight and to acceptance testing: 
•For actively controlled systems such as Heaters, ThermoElectric Coolers (TECs), Loop Heat Pipes (LHPs), 
Capillary Pumped Loops (CPLs), or other devices with selectable/ variable set points, a test temperature 
margin of no less than 5°C shall be imposed on the respective set point band that is under control. 

•For components/subsystems/payloads with operational heater circuits with fixed temperature setpoints, the 
margin may be reduced from io°C to 5°C. 

•If a component/subsystem/payload has an active control whose range is not selectable/ variable such 
that the control system will not allow the hardware to be stressed via temperature, then the stressing shall be 
induced by the increase or decrease of a heat load (internal or external) of at least 30 %. The active 
temperature control hardware shall maintain control under these stressed conditions. 

The survival/safehold thermal-vacuum test shall consist of driving the element, without any test margin, to the 
desired temperature, and then returning that element to the qualification temperature to functionally check the 
operation. No component shall be allowed to exceed the non-operating temperature limit with allowable 
tolerances. 
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Example 2: Defining the Qualification Goals 
for the Requirements Table 



The MEB PDL from example 1 said there was no problem having the survival limit at -35 0 C and that the 
box could be on between -35 0 C and +45 0 C but it may not be in spec. You adjusted your limits 
accordingly based on his updated information (see below). What would be the qualification goals? 


Limit Type 

Limits Table 

Qualification Goals 

Notes 

Operational (AFT) 

-20 to +30° C 

-30 to +40° C 

± io° C GEVS 

Survival 

-3 5 to +55 0 C 

-35 to +55 0 C 

No Margin Required GEVS 

Turn-On 

-35 to + 45 ° C 

-35 to +45 0 C 

No Margin Required 


The table above assumes that the MEB is passively controlled. If an operational heater is used to 
maintain the MEB temperature then the qualification goal range could be reduced to -25 to +40° C. 
However since the MEB PDL has given the project a range of operation (in spec) of -30 to +40° C it 
would be better to adjust the AFT limit (see table below). It is always better to define a wider 
requirements range, especially at the SRR to PDR level since the design is evolving. 


Recommended Change in Requirement if MEB was Actively Controlled by a Heater 


Limit Type 

Limits 

Qualification Goals 

Notes 

Operational (AFT) 

-25 to +30 C 

-30 to +40 C 

-5 /+ 10 C GEVS 
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Qualification Goals from Predictions 



Qualification goals for Component level testing should never be based on predicts*. We strive to 
achieve these same “component level” goals for Subassembly, Instrument, and Observatory 
level testing. Identify components that will not meet qualification goals at higher levels of 
testing and compare to analytical predictions. The minimum qualification required margin is 
+15 C of worst-case predicts (+ 10 C GEVS requirement and the ± 5 C modeling GOLD rules 
margin). Make sure that the project systems team and PDL understand the limitations. You 
may be required to perform additional cycles at the component level, change limits, or obtain a 
waiver. 

Qualification goals may be based on predicts if the thermal model has been correlated. The 
minimum required qualification margin is +15 C of worst-case predicts. 

*If a component’s design has been previously qualified to a very large temperature range the project may 
want to base the qualification goals on analysis. Testing to extreme levels would increase test 
schedule/cost and may not be possible because of adjacent hardware limitations. The branch 
recommends that the minimum qualification margin be widen to minimum of +20 C (op) and + 10 C 
(non-op) since predicts would be with an uncorrelated model. Components may need wider margins 
in certain circumstances (e.g. Passively controlled isolated components, extreme environments, less 
mature designs, etc.) 


Remember to discuss tolerances and gradients with the component PDL! 
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GEVS Wording for When You Can Use 
Predictions to Set Qualification Goals 



The max/min temperatures to be imposed during the TVAC test shall represent, 
as indicated above, a temperature range large enough, including margins, to 
induce stress during temperature cycling. The basis for the test temperatures 
shall be established either by program requirements or by predicted 
temperatures derived analytically using a test verified model . The latter 
means that worst case flight predictions will be generated from a thermal 
analytical model which has been correlated satisfactorily to thermal 
balance test results . When a thermal balance test precedes the thermal 
vacuum test, results from that test shall be used to refine the thermal vacuum 
test criteria, presuming that there is sufficient time to correlate the model and 
generate updated predictions prior to the thermal vacuum test. If predictions 
from a verified model are not available at the time of the thermal vacuum test, 
the basis shall be Project Office established, on-orbit maximum and minimum 
allowable operating limits. This basis shall constitute the “flight” temperature 
range to which test margins shall be applied. 
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Example 3 : Qualification Goal from Analysis 

Predictions 



A passively controlled potentiometer is on your instrument. This is used for a single-use deployment of a sun 
shield. It is a commercially available component whose design has been qualified to -65 to +125 0 C for other 
missions. These levels can not be achieved at the instrument level due to constraints on adjacent hardware. 
The predicted temperature range at deployment is -27 to io° C. The predicted temperature range prior to 
deployment is -42 to +15 0 C and post-deployment is -55 to + 70° C. What should the potentiometer be 
qualified to? 


The potentiometer should be cycled to a minimum op range of -47 to +30 0 C (+ 20° C predicts*). AFT at 

deployment would be -37 to +20° C. The survival qualification range is dependant on the project requirement. 
In many instances the flight deployment hardware is not cycled to post-deployment values (e.g. NEI - non- 
explosive initiator). The minimum range for non-op qualification would be -52 to +30 0 C . Note that the non- 
op range should be at least + io° C predicts. In the non-op “hot case” this would be +25°C. However the non- 
op qualification range should be at least as extreme as the op qualification range; therefore the non-op hot 
range must be at least +30° C. 


Notes: 

• For items that are deployed multiple times in a mission the post-deployment predictions should be used to set survival 
qualification limits. 

• If the thermal model has been correlated then then the cycling range can be reduced to + io° C predicts operationally and + 0° C 
predicts survival. Always adjust predicts based on correlation delta in a conservative manner. 

• The test red survival limit can be set at -65 to +125 0 C since the component has been qualified to these levels for previous missions. 

* branch recommendation per “Qualification Goals from Predictions” slide is at least ± 20 ° C predicts unless model is correlated 
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Qualification Goals and Limit Tolerances 



• Allowable limits tolerances are added to the qualification goals (GEVS) 

• GSFC Facilities and the thermal test conductors are required to take action to ensure that red limits 


are not hit. The Facility operators require at least 3 0 C of margin beyond the qualification goal. 

• Hardware is taken to qualification goals during the test but temperature may be slightly outside of 
range for a limited period of time. 

• The thermal PDL may determine that the a larger than 3 C tolerance is required on select components 
(i.e. light weight, extreme environment, or isolated). 

• The Component PDL and project systems engineer should be in agreement that the hardware may be 
taken to the qualification goal plus tolerance. Otherwise the qualification goal and table must be 
updated. Include a note with the requirements table that a test tolerance will be 
added to qualification goals to determine sensor limits in test. 

Cold temperature <— > > Hot temperature 

range that could 
be seen in test 
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DEVELOPING THE TEST SENSOR LIMITS 

SPREADSHEET 



THIS ACTIVITY IS DONE PRIMARILY AFTER 
THE PRELIMINARY DESIGN REVIEW (PDR) . 

A SPREADSHEET IS CREATED FOR EACH TEST 
DUE TO VARIATIONS IN SENSOR LOCATION 
AND TEST CONDITIONS 
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Spreadsheet of Sensor Limits 



• After PDR the table of limits and qualification goals should be 
complete. There may be updates based on design maturity that is 
vetted through the systems engineering team. The branch recommends 
that the project has the table under configuration management after 
PDR. 

• The next product that the thermal PDL must develop is the test limits 
for each sensor (both flight and test sensors). The Thermal PDL must: 

o Base the spreadsheet on the requirements table and pretest analysis, 
o Understand where and when the requirement tables limits apply. 

o Know the gradients within components. This may vary with test configuration and/ or 
hardware state. Actual sensor limits at “non-requirement” locations are adjusted 
based on gradients. 

o Apply appropriate test tolerances to limits, 
o Define both Red and Yellow Limits 

o Get Component PDLs to review and approve spreadsheet prior to test 
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Red limits represent a level that the hardware 



should not exceed. Damage may result if red limits 
are exceeded. 

Yellow limits represent a condition where the 
hardware will not be harmed. Yellow limits should be 
set so that they alert test conductors to issues and 
allow them sufficient time to react before a red limit 
is hit. 

' \w 

k 
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Example 4: Determining the Test Sensor Limit 
in the Database at the Requirement Location 



From example 2 the passively controlled MEB has the following limits and qualification goals established at the 
interface location. 


Limit Type 

Limits Table 

Qualification Goals 

Notes 

Operational (AFT) 

-20 tO +30° C 

-30 to +40° C 

± to 0 C GEVS 

Survival 

-35 to +55 0 C 

-35 to +55 0 C 

No Margin Required GEVS 

Turn-On 

-35 to +45 0 C 

-35 to +45 0 C 

No Margin Required 


The thermal PDL has received concurrence from the component PDL/ systems that a limits tolerance of ± 3 0 C 
can be used in developing the sensor limits in the database for op and non-op limits. However the hot turn has 
a NTE temperature of +45 0 C. What are the red and yellow limits at the interface that should be set? 


Limit Type 

Qualification 

Goals 

Limits 

Tolerances 

Test Red Limits 
Sensor at 
Interface 

Widest Test Yellow 
Limits I/F sensor 

Operational 

-30 to +40° C 

±3° C 

-33 to +43 0 C 

-31 to +41 0 C 

Survival 

-35 to +55 0 C 

±3° C 

-38 to +58° C 

-36 to +56° C 

Turn-On 

-35 to +45 0 C 

-3/+0 0 C 

-38 to +45 0 C 

See note below 


Yellow 
maximum 
range +1 0 C 
outside of goal 


•The turn-on limits are typically enforced by writing a conditional step in the test procedure instead of changing the limits database. 
•The yellow limits listed above represent the widest limits allowable. The thermal PDL’s engineering judgment must be used to 
establish the yellow limits to adequately warn personnel so that the red limit is not exceeded. 
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Sensor Position 



• The test sensor limits that are put into flight and test data 
collection systems (TVDS) must take into account the 
location of sensors with respect to the requirement. The 
test sensor limits may be outside the “requirement levels” 
due to the gradients within the component. 

• Branch recommends that the red sensor limits 
encompass the entire box temperature range (slightly 
wider range of limits) since gradient predictions are 
based on an uncorrelated model, (see example) 

• The component PDL MUST approve the test sensor 
limits. 
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Example 5 : Test Limits and Sensor Position 



The MEB requirement was based on the interface temperature. Sensor limits for the interface sensor were 
set per example 4. There is a 6° C linear gradient from top-to-bottom of the box operationally. When 
the box is off the gradient reverses to a -4 0 C gradient. What would be the test temperature limits of the 
sensors at the interface, and the top of the box? Sensor 



Limit 

Type 

Qualification 

Goals 

Limits 

Tolerances 

Limit 

Type 

Test Limits 
Sensor @ I/F 
Example 4 

Test Limits 
Sensor @ Top 

Adding Gradient 
Predictions* 

Test Limits 
Sensor @ Top 

Branch Recommended 
Range* 

Operational 

-30 to +40° C 

±3° C 

Yellow** 

-31 to +41 0 C 

-25 to +47 0 C 

-31 to +47 0 C 




Red 

-33 to +43° C 

-27 to +49 0 C 

-33 to +49 0 C 

Survival 

-35 to +55 0 C 

±3° C 

Yellow** 

-36 to +56° C 

-40 to +52 0 C 

-40 to +56° C 




Red 

-38 to +58° C 

-42 to +54 0 C 

-42 to +58° C 


*The component PDL must verity all sensor test limits. Branch recommends widest limits that PDL verifies that the 
hardware is safe since gradient predicts are based on uncorrelated models. 

** Yellow is at discretion of thermal PDL values in table are the maximum extremes of the range recommended 
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Branch Interpretation of GEVS 


GEVS: 

Temperatures shall not exceed allowable qualification temperatures for extended periods of time. 
This may constrain the test to be driven by those components with the smallest allowable 
temperature range. Also, for testing at higher levels of assembly, the “red limits” (not-to-exceed 
temperatures) shall be established based on temperatures actually achieved during testing at 
lower levels of assembly. 

The Quandary is that if a red limit must be based on the lower levels of assembly by 

definition at higher levels of assembly the component must be qualified 2 or 3 0 C LESS 
than at the component level. 

Branch Guidelines in Implementation 

•Keep sensor limits consistent between tests 
•Adjust qualification soak goal tolerances accordingly 

See example on next page on implementation 
The soak goal tolerance describes the range of temperatures that 
would be acceptable for actual qualification (not the limit tolerance ). 

The thermal PDL defines this in the test plan (+ 2 C is assumed for the example) 
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Example6: Progression of Qualification Goals 

and Associated Tolerances 


The actual component qualification 
temperatures for example 5 are listed 
below. What are the qualification 
goals/tolerances that would be applied 
for higher levels of testing? 



Cold Goal set to the value 
that was achieved in the 
component level test 


Hot Goal set to the 
qualification goal 


\ 




Limit 

Type 

Qualification 

Goals 

Component Level 

Red Test 
Limit of 
Sensor 

Actual 

Qualification 
Component Level 

Qualification Goals 
Higher Level 

Actual 

Qualification 
Higher Level 

Op 

(soak goal 
tolerance) 

-30 to +40° C 

(+2° C) (+2°C) 

-33 to +43 0 C 

(includes +3 C limits 
tolerance) 

-29 to +41 0 C 

•Al 

-29 to +40° C 

(- 0 /+ 2 °C) (- 2 / + 1 ° C) 

-28 to +39 0 C 

Non-Op 

(tolerance) 

-35 to +55 0 C 

(+2° C) (+2°C) 

-38 to +58° C 

(includes +3 C limits 
tolerance) 

-35 to +52 0 C 

-35 to +52 0 C 

(-0/+2°C) (-2/+0°C)*\. 

-33 to +50 0 C 


Note that the goal tolerances for the higher level qualification specified in the test plan are set 
to achieve the temperature levels seen in the component level test without exceeding them for 
a substantial period of time. The Red Limits for the sensor can remain -33 to +43 0 C (op) 
and -38 to +58° C (non-op) throughout the test program. It is recommended that yellow 
limits be adjusted at the higher level qualification test to alert operators that temperatures are 
near qualification goals . 


Hot Goal set to the value 
that was achieved in 
component test non-op 
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Developing the Sensor Test Limits Spreadsheet 

Reality of Testing 



• Understand how the limits are changed (op versus non-op) in the test 
system. Systems may require that limits be MANUALLY changed 
(line-by-line) by the operator during testing. Human error can occur. 


• Identify Non-op and Op limits changes and when they apply during 
test. (Note that some components may be OFF when the spacecraft or 
instrument is operational). Understand when and how to change flight 
sensor limits during the test. 

• Each terminal may need to be updated when you change limits of flight 
sensors -> Make sure everyone is using consistent and correct limits. 

• General branch policy: Do not plan to take hardware to temperatures 
more extreme than in previous testing UNLESS the project management, 
quality assurance, and the branch have approved. This is implemented 
through the qualification goals listed in the test plan. Throughout the test 
program (l) The red limits can remain consistent and (2) the yellow limits 
can be adjusted to reflect the updated qualification goals. 
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Defining and Applying Limits 
for Test and Flight 



LIFECYCLE PHASE 


DEFINING SENSOR LIMITS 

FOR FLIGHT 
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Developing the Sensor-by-Sensor 
Flight Limits Spreadsheet 



• Utilize requirements table with worst-case sensor test gradients 


• Flight Software may have a default limit set of limits with “overlays” that can 
be commanded depending on the state of the payload. 

• Limits can be overridden at individual terminals -> know what limits are active. 

• Define Limits Set -> Keep it as simple as possible 

Which components are operating during this phase of the mission or hardware state? 

o Example: A satellite original limits for safehold had the reaction wheels with “non-op” 
values. However since these are critical to maintaining S/C orientation they were 
operating. The misunderstanding in when limits applied led to having to replace 
survival heater thermostats to maintain the wheels at op levels. 


TFAWS 2015 Carol Mosier 



Example 7: Implementing Flight Limits 



Given the actual temperatures that the sensor achieved in example 6 
what would be the flight red/yellow limits? 


Limit 

Type 

Limits Table 
Requirement 

Red Test Limit 
of Sensor 

Actual 

Qualification 

Component 

Level 

Actual 

Qualification 
Higher Level 

Flight Red 
Limit 

Possible 
Flight Yellow 
Limits 

Op 

-20 to +30° C 
(AFT) 

-33 to +43 0 C 

-29 to +41 0 C 

-28 to +39 0 C 

-29 to +41 0 C 

-21 tO +31° C 

Non-Op 

-35 to +55 0 C 

-38 to +58° C 

-35 to +52 0 C 

-33 to +50° C 

-35 to +52 0 C 

-30 to +47 0 C 


•The branch policy is that the flight red limit shall be no wider than the maximum level of temperatures seen 
during the qualification program. 

•The thermal PDL may utilize more narrow limits based on their engineering judgment. For example they 
may elect to use values seen in the higher level qualification if the interface/gradients seen in component level 
testing was not flight-like. 

•Yellow limits are set by the thermal PDL to ensure that the operators are alerted to non-nominal conditions 
and allow sufficient time to react prior to exceeding red limits. The branch recommends a minimum of 5 0 C 
difference between yellow and red limits. It is also recommended that the op yellow limits be set no more 
than i° C outside of AFT. Engineering judgment in setting the yellow limits is particularly important for 
cryogenic systems, high temperature systems, light-weight components, and components exposed to extreme 
environments. 
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Defining and Applying Limits 
for Test and Flight 



SUMMARY 
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Summary - General 



• The method for setting limits shown in this presentation is the Goddard 
Thermal Branch standard policy. Other NASA centers and private industry 
may utilize different standards and definitions of limits. 


• Limits continually evolve throughout the project lifecycle. 

• Thermal limits should be based on hardware limitations 

• Understand how limits are applied for mission modes (e.g. op/non-op). 

• Know the control method (active, passive, fixed set-point) and margins 
requirements. 

• Develop Requirements Table of Limits and Qualification Goals, and Sensor 
Spreadsheets of Test/Flight Limits. 
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